CCS passes Hardware to Security Policy, under PoP. SP2.2 "Physical Assets". Rest is as per §A.1.i.